onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-15 01:19:29 +02:00
Code Issues Releases Wiki Activity

fixed #1633 use ipset module in NATCompiler_ipt

Browse Source
This commit is contained in:
Vadim Kurland
2010-07-24 06:03:48 +00:00
parent e7983c0eeb
commit 1a8d8cd1ea
7 changed files with 187 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build_num
+1 -1
View File
@@ -1 +1 @@
#define BUILD_NUM 3146
#define BUILD_NUM 3149
src/iptlib/NATCompiler_PrintRule.cpp
+32 -4
View File
@@ -501,6 +501,20 @@ string NATCompiler_ipt::PrintRule::_printDstService(RuleElementOSrv *rel)
return ostr.str();
}
string NATCompiler_ipt::PrintRule::_printIpSetMatch(Address *o, RuleElement *rel)
{
NATCompiler_ipt *ipt_comp=dynamic_cast<NATCompiler_ipt*>(compiler);
string set_name =
dynamic_cast<OSConfigurator_linux24*>(ipt_comp->osconfigurator)->normalizeSetName(o->getName());
string suffix = "dst";
if (RuleElementOSrc::isA(rel)) suffix = "src";
if (RuleElementODst::isA(rel)) suffix = "dst";
string set_match = "--set " + set_name + " " + suffix;
ostringstream ostr;
ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match);
return ostr.str();
}
// Note print_mask is true by default, print_range is false by default.
string NATCompiler_ipt::PrintRule::_printAddr(Address *o,
bool ,
@@ -659,9 +673,17 @@ bool NATCompiler_ipt::PrintRule::processNext()
const InetAddr *osrc_addr = osrc->getAddressPtr();
if (osrc_addr==NULL || !osrc_addr->isAny())
{
string osrc_out = _printAddr(osrc);
if (!osrc_out.empty())
cmdout << _printSingleOptionWithNegation(" -s", osrcrel, osrc_out);
MultiAddressRunTime *atrt = MultiAddressRunTime::cast(osrc);
if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME &&
ipt_comp->using_ipset)
{
cmdout << _printIpSetMatch(osrc, osrcrel);
} else
{
string osrc_out = _printAddr(osrc);
if (!osrc_out.empty())
cmdout << _printSingleOptionWithNegation(" -s", osrcrel, osrc_out);
}
}
// cmdout << " -s ";
@@ -676,7 +698,13 @@ bool NATCompiler_ipt::PrintRule::processNext()
if (!odst->isAny())
{
cmdout << _printSingleOptionWithNegation(" -d", odstrel, _printAddr(odst));
MultiAddressRunTime *atrt = MultiAddressRunTime::cast(odst);
if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME &&
ipt_comp->using_ipset)
{
cmdout << _printIpSetMatch(odst, odstrel);
} else
cmdout << _printSingleOptionWithNegation(" -d", odstrel, _printAddr(odst));
}
cmdout << " ";
src/iptlib/NATCompiler_ipt.cpp
+4
View File
@@ -214,6 +214,10 @@ int NATCompiler_ipt::prolog()
}
}
string version = fw->getStr("version");
using_ipset = (XMLTools::version_compare(version, "1.4.1.1") >= 0 &&
fwopt->getBool("use_m_set"));
return n;
}
src/iptlib/NATCompiler_ipt.h
+4 -1
View File
@@ -60,7 +60,8 @@ namespace fwcompiler {
class PrintRule;
NATCompiler_ipt::PrintRule *printRule;
bool have_dynamic_interfaces;
bool have_dynamic_interfaces;
bool using_ipset;
std::map<std::string, int> chain_usage_counter;
// use minus_n_commands map to track creation of chains.
@@ -535,6 +536,8 @@ namespace fwcompiler {
virtual std::string _printAddr(libfwbuilder::Address *o,
bool print_mask=true,
bool print_range=false);
virtual std::string _printIpSetMatch(
libfwbuilder::Address *o, libfwbuilder::RuleElement *rel);
virtual std::string _printChainDirectionAndInterface(libfwbuilder::NATRule *r);
virtual std::string _printSingleObjectNegation(libfwbuilder::RuleElement *rel);
src/iptlib/PolicyCompiler_PrintRule.cpp
+16 -16
View File
@@ -1133,14 +1133,7 @@ string PolicyCompiler_ipt::PrintRule::_printSrcAddr(RuleElement *rel, Address *
if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME &&
ipt_comp->using_ipset)
{
ipt_comp->actually_used_module_set = true;
string set_name =
dynamic_cast<OSConfigurator_linux24*>(ipt_comp->osconfigurator)->normalizeSetName(o->getName());
ipt_comp->ipset_tables[set_name] = atrt->getSourceName();
string set_match = "--set " + set_name + " src";
ostringstream ostr;
ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match);
return ostr.str();
return _printIpSetMatch(o, rel);
}
return _printSingleOptionWithNegation(" -s", rel, _printAddr(o));
@@ -1170,19 +1163,26 @@ string PolicyCompiler_ipt::PrintRule::_printDstAddr(RuleElement *rel, Address *
if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME &&
ipt_comp->using_ipset)
{
ipt_comp->actually_used_module_set = true;
string set_name =
dynamic_cast<OSConfigurator_linux24*>(ipt_comp->osconfigurator)->normalizeSetName(o->getName());
ipt_comp->ipset_tables[set_name] = atrt->getSourceName();
string set_match = "--set " + set_name + " dst";
ostringstream ostr;
ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match);
return ostr.str();
return _printIpSetMatch(o, rel);
}
return _printSingleOptionWithNegation(" -d", rel, _printAddr(o));
}
string PolicyCompiler_ipt::PrintRule::_printIpSetMatch(Address *o, RuleElement *rel)
{
PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
string set_name =
dynamic_cast<OSConfigurator_linux24*>(ipt_comp->osconfigurator)->normalizeSetName(o->getName());
string suffix = "dst";
if (RuleElementSrc::isA(rel)) suffix = "src";
if (RuleElementDst::isA(rel)) suffix = "dst";
string set_match = "--set " + set_name + " " + suffix;
ostringstream ostr;
ostr << "-m set " << _printSingleOptionWithNegation("", rel, set_match);
return ostr.str();
}
string PolicyCompiler_ipt::PrintRule::_printAddr(Address *o)
{
PolicyCompiler_ipt *ipt_comp=dynamic_cast<PolicyCompiler_ipt*>(compiler);
src/iptlib/PolicyCompiler_ipt.h
+2
View File
@@ -1005,6 +1005,8 @@ public:
virtual std::string _printDstAddr(libfwbuilder::RuleElement *rel,
libfwbuilder::Address *o);
virtual std::string _printAddr(libfwbuilder::Address *o);
virtual std::string _printIpSetMatch(
libfwbuilder::Address *o, libfwbuilder::RuleElement *rel);
virtual std::string _printSingleObjectNegation(
libfwbuilder::RuleElement *rel);
virtual std::string _printChain(libfwbuilder::PolicyRule *r);
test/ipt/objects-for-regression-tests.fwb
+128 -2
View File
@@ -53353,8 +53353,71 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
<Option name="verify_interfaces">True</Option>
</FirewallOptions>
</Firewall>
<Firewall id="id56583X26628" host_OS="linux24" inactive="False" lastCompiled="1279850008" lastInstalled="0" lastModified="1279855256" platform="iptables" version="1.4.1.1" name="firewall41-1" comment="testing run time address table objects with module set" ro="False">
<Firewall id="id56583X26628" host_OS="linux24" inactive="False" lastCompiled="1279850008" lastInstalled="0" lastModified="1279949656" platform="iptables" version="1.4.1.1" name="firewall41-1" comment="testing run time address table objects with module set" ro="False">
<NAT id="id56688X26628" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<NATRule id="id985478X9995" disabled="False" position="0" action="Translate" comment="">
<OSrc neg="False">
<ObjectRef ref="id44F7056328576"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id56591X26628"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions/>
</NATRule>
<NATRule id="id2287813X9995" disabled="False" group="" position="1" action="Translate" comment="">
<OSrc neg="True">
<ObjectRef ref="id44F7056328576"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id56591X26628"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions/>
</NATRule>
<NATRule id="id985500X9995" disabled="False" group="" position="2" action="Translate" comment="">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="id44F7056328576"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="id46523X95438"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions/>
</NATRule>
<RuleSetOptions/>
</NAT>
<Policy id="id56601X26628" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
@@ -53705,8 +53768,71 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
<Option name="verify_interfaces">True</Option>
</FirewallOptions>
</Firewall>
<Firewall id="id4374266X29460" host_OS="openwrt" inactive="False" lastCompiled="1279850008" lastInstalled="0" lastModified="1279855986" platform="iptables" version="1.4.3" name="firewall41-2" comment="testing run time address table objects with module set&#10;use module set is turned off&#10;" ro="False">
<Firewall id="id4374266X29460" host_OS="openwrt" inactive="False" lastCompiled="1279850008" lastInstalled="0" lastModified="1279949642" platform="iptables" version="1.4.3" name="firewall41-2" comment="testing run time address table objects with module set&#10;use module set is turned off&#10;" ro="False">
<NAT id="id4374396X29460" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
<NATRule id="id1543124X9995" disabled="False" group="" position="0" action="Translate" comment="">
<OSrc neg="False">
<ObjectRef ref="id44F7056328576"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id56591X26628"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions/>
</NATRule>
<NATRule id="id2101361X9995" disabled="False" group="" position="1" action="Translate" comment="">
<OSrc neg="True">
<ObjectRef ref="id44F7056328576"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="id56591X26628"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions/>
</NATRule>
<NATRule id="id1543070X9995" disabled="False" group="" position="2" action="Translate" comment="">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="id44F7056328576"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="id46523X95438"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions/>
</NATRule>
<RuleSetOptions/>
</NAT>
<Policy id="id4374284X29460" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">